Hunt List
12,815 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-12293 |
9.8 | 0.0030 | NET NO AUTH LOW CX NO UI | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed i | |
|
80
|
CVE-2026-9205 |
9.8 | 0.0030 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in t | |
|
79
|
CVE-2026-39795 |
9.3 | 0.0030 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-105869 |
9.2 | 0.0030 | NET NO AUTH LOW CX NO UI | Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with al | |
|
78
|
CVE-2026-35676 |
8.8 | 0.0030 | NET NO AUTH LOW CX NO UI | phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability i | |
|
77
|
CVE-2026-91219 |
8.6 | 0.0030 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
77
|
CVE-2026-11317 |
8.7 | 0.0030 | NET NO AUTH LOW CX NO UI | A denial of service security issue exists in the affected product. The security | |
|
76
|
CVE-2026-118262 |
8.2 | 0.0030 | NET NO AUTH LOW CX NO UI | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy mid | |
|
75
|
CVE-2026-34891 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce | |
|
75
|
CVE-2026-91307 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
75
|
CVE-2026-91308 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
75
|
CVE-2026-91465 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product | |
|
75
|
CVE-2026-100164 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Observable response discrepancy vulnerability in Rolantis Information Technologi | |
|
75
|
CVE-2026-118083 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. | |
|
75
|
CVE-2026-25204 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data vulnerability in Samsung Open Source Escargot | |
|
74
|
CVE-2026-20035 |
7.2 | 0.0030 | NET NO AUTH LOW CX NO UI | A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an | |
|
69
|
CVE-2026-47407 |
9.4 | 0.0030 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
68
|
CVE-2026-7498 |
8.8 | 0.0030 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
68
|
CVE-2026-42998 |
8.8 | 0.0030 | NET LOW CX NO UI | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone applic | |
|
68
|
CVE-2026-17920 |
8.8 | 0.0030 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker | |
|
68
|
CVE-2026-7899 |
8.8 | 0.0030 | NET NO AUTH LOW CX | Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allow | |
|
67
|
CVE-2026-116201 |
8.7 | 0.0030 | NET LOW CX NO UI | Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows | |
|
67
|
CVE-2026-49046 |
8.5 | 0.0030 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-116819 |
8.4 | 0.0030 | NET LOW CX NO UI | OpenPanel before 3.0.0 contains an information disclosure vulnerability that all | |
|
67
|
CVE-2026-19198 |
8.7 | 0.0030 | NET LOW CX NO UI | Akaunting 3.1.21 contains an authenticated improper authorization vulnerability | |
|
66
|
CVE-2026-13774 |
8.1 | 0.0030 | NET NO AUTH NO UI | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an | |
|
65
|
CVE-2026-55201 |
7.4 | 0.0030 | NET NO AUTH LOW CX | Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulne | |
|
65
|
CVE-2026-105483 |
7.4 | 0.0030 | NET NO AUTH NO UI | A flaw in Node.js TLS hostname verification allows a certificate without a match | |
|
65
|
CVE-2026-106069 |
7.4 | 0.0030 | NET NO AUTH NO UI | A flaw in Node.js TLS hostname verification can cause a server certificate to be | |
|
65
|
CVE-2026-86377 |
7.6 | 0.0030 | NET LOW CX NO UI | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS | |
|
65
|
CVE-2026-45373 |
7.4 | 0.0030 | NET NO AUTH LOW CX | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, althou | |
|
64
|
CVE-2026-119208 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf | |
|
64
|
CVE-2026-119204 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf | |
|
64
|
CVE-2026-119205 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf | |
|
64
|
CVE-2026-119206 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf | |
|
64
|
CVE-2026-119207 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf | |
|
64
|
CVE-2026-119203 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf | |
|
64
|
CVE-2026-6865 |
7.1 | 0.0030 | NET LOW CX NO UI | CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Trave | |
|
64
|
CVE-2026-69115 |
7.1 | 0.0030 | NET LOW CX NO UI | OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows | |
|
61
|
CVE-2026-54423 |
8.2 | 0.0030 | NET LOW CX NO UI | In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nod | |
|
60
|
CVE-2026-115365 |
7.5 | 0.0030 | NET LOW CX NO UI | OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerabilit | |
|
57
|
CVE-2026-13025 |
8.3 | 0.0030 | NET NO AUTH | Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attac | |
|
57
|
CVE-2026-13813 |
8.3 | 0.0030 | NET NO AUTH | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior | |
|
56
|
CVE-2026-54271 |
8.2 | 0.0030 | NET NO AUTH | protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2. | |
|
55
|
CVE-2026-17887 |
7.5 | 0.0030 | NET NO AUTH | Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a rem | |
|
55
|
CVE-2026-19142 |
7.5 | 0.0030 | NET NO AUTH | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remot | |
|
55
|
CVE-2026-19158 |
7.5 | 0.0030 | NET NO AUTH | Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allo | |
|
55
|
CVE-2026-19159 |
7.5 | 0.0030 | NET NO AUTH | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remot | |
|
55
|
CVE-2026-113499 |
7.5 | 0.0030 | NET NO AUTH | The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its H | |
|
55
|
CVE-2026-113500 |
7.5 | 0.0030 | NET NO AUTH | The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML |